Merge pull request #50 from CodeAnt-AI/pranav/cod-1557-computrition-cli-review-base-base-commit-silently-override

Include uncommitted and untracked files in --base/--base-commit (0.5.12)

Author: pranavcodeant

README.md

@@ -16,8 +16,11 @@ For installation, authentication, and self-hosted setup, see the [CodeAnt CLI se
 # Login to CodeAnt
 codeant login
 
-# Scan staged files for secrets
+# Scan your changes for secrets
 codeant secrets
+
+# Review your changes
+codeant review
 ```
 
 ## Usage
@@ -56,22 +59,26 @@ codeant secrets [options]
 
 | Option | Description |
 |--------|-------------|
-| `--staged` | Scan only staged files (default) |
-| `--all` | Scan all changed files compared to base branch |
-| `--uncommitted` | Scan all uncommitted changes |
+| `--all` | Scan committed (unpushed) + uncommitted changes, including untracked files (default) |
+| `--committed` | Scan only unpushed commits |
+| `--uncommitted` | Scan staged + unstaged + untracked changes |
+| `--staged` | Scan only staged files |
 | `--last-commit` | Scan files from the last commit |
+| `--last-n-commits <n>` | Scan files from the last n commits (max 5) |
+| `--base <branch>` | Scan committed + uncommitted + untracked changes since the merge-base with `<branch>` |
+| `--base-commit <commit>` | Scan committed + uncommitted + untracked changes since `<commit>` |
 | `--fail-on <level>` | Fail only on HIGH, MEDIUM, or all (default: HIGH) |
 | `--include <patterns>` | Comma-separated glob patterns to include files |
 | `--exclude <patterns>` | Comma-separated glob patterns to exclude files |
 
 **Examples:**
 
 ```bash
-# Scan staged files (default)
+# Scan all changed files (default)
 codeant secrets
 
-# Scan all changed files
-codeant secrets --all
+# Scan only staged files
+codeant secrets --staged
 
 # Scan last commit
 codeant secrets --last-commit
@@ -108,6 +115,46 @@ Use `--include` and `--exclude` with glob patterns to filter files:
 - `MEDIUM` - Medium confidence, may need review
 - `FALSE_POSITIVE` - Detected but likely not a real secret (always ignored)
 
+#### `review`
+
+Run an AI code review on your local changes.
+
+```bash
+codeant review [options]
+```
+
+**Options:**
+
+| Option | Description |
+|--------|-------------|
+| `--all` | Review committed (unpushed) + uncommitted changes, including untracked files (default) |
+| `--committed` | Review only unpushed commits |
+| `--uncommitted` | Review staged + unstaged + untracked changes |
+| `--staged` | Review only staged files |
+| `--last-commit` | Review the last commit |
+| `--last-n-commits <n>` | Review the last n commits (max 5) |
+| `--base <branch>` | Review committed + uncommitted + untracked changes since the merge-base with `<branch>` |
+| `--base-commit <commit>` | Review committed + uncommitted + untracked changes since `<commit>` |
+| `--fail-on <level>` | Fail on issues at or above BLOCKER, CRITICAL, MAJOR, MINOR, or INFO (default: CRITICAL) |
+| `--include <patterns>` | Comma-separated glob patterns to include files |
+| `--exclude <patterns>` | Comma-separated glob patterns to exclude files |
+| `--headless` | Print JSON with no spinners (for agents and CI) |
+
+`--base` and `--base-commit` take precedence over the other scope flags. They compare the base against your working tree, so staged, unstaged, and untracked files are reviewed along with commits. Files ignored by `.gitignore` are never reviewed. The same applies to `secrets`.
+
+**Examples:**
+
+```bash
+# Review everything on your branch since it left main, including uncommitted and new files
+codeant review --base main
+
+# Review only uncommitted work
+codeant review --uncommitted
+
+# CI: fail on MAJOR or worse, JSON output
+codeant review --base main --fail-on MAJOR --headless
+```
+
 #### `set-base-url <url>`
 
 Set a custom API base URL.

changelog.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.5.12] - 13/10/2026
+- `review` / `secrets` with `--base` or `--base-commit` now include staged, unstaged, and untracked files (respecting `.gitignore`), not just commits. Previously `review --all --base main` silently skipped new files
+- With `--base` / `--base-commit`, file content is read from the working tree so it matches the reviewed diff
+- Help text, the README, and the MCP `codeant_review_local` parameters describe what `--base` / `--base-commit` include and that they take precedence over the other scope flags; the README gains a `review` section and corrects the `secrets` scope options
+
 ## [0.5.11] - 05/10/2026
 - `codeant login` shows every status check with the HTTP response, login status, or request error, while masking the token in request diagnostics
 

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeant-cli",
-  "version": "0.5.11",
+  "version": "0.5.12",
   "description": "Code review CLI tool",
   "type": "module",
   "repository": {

package.json

@@ -72,8 +72,8 @@ program
   .option('--staged', 'Scan only staged files')
   .option('--last-commit', 'Scan last commit')
   .option('--last-n-commits <n>', 'Scan last n commits (max 5)', toCount)
-  .option('--base <branch>', 'Compare against a specific base branch (e.g. --base develop)')
-  .option('--base-commit <commit>', 'Compare against a specific commit (e.g. --base-commit HEAD~3)')
+  .option('--base <branch>', 'Scan committed + uncommitted + untracked changes since the merge-base with a branch (e.g. --base develop). Takes precedence over the other scope flags')
+  .option('--base-commit <commit>', 'Scan committed + uncommitted + untracked changes since a commit (e.g. --base-commit HEAD~3). Takes precedence over the other scope flags')
   .option('--include <paths>', 'Comma-separated list of file paths glob patterns to include')
   .option('--exclude <paths>', 'Comma-separated list of file paths glob patterns to exclude')
   .option('--hook', 'Running from pre-commit hook (enables bypass prompt)')
@@ -83,6 +83,8 @@ program
     let baseBranch = null;
     let baseCommit = null;
 
+    // Precedence: --base > --base-commit > other scope flags. The base modes already diff
+    // against the working tree, so they include uncommitted and untracked changes too.
     if (options.base) {
       scanType = 'base-branch';
       baseBranch = options.base;
@@ -123,8 +125,8 @@ program
   .option('--staged', 'Review only staged files')
   .option('--last-commit', 'Review last commit')
   .option('--last-n-commits <n>', 'Review last n commits (max 5)', toCount)
-  .option('--base <branch>', 'Compare against a specific base branch (e.g. --base develop)')
-  .option('--base-commit <commit>', 'Compare against a specific commit (e.g. --base-commit HEAD~3)')
+  .option('--base <branch>', 'Review committed + uncommitted + untracked changes since the merge-base with a branch (e.g. --base develop). Takes precedence over the other scope flags')
+  .option('--base-commit <commit>', 'Review committed + uncommitted + untracked changes since a commit (e.g. --base-commit HEAD~3). Takes precedence over the other scope flags')
   .option('--fail-on <level>', 'Fail on issues at or above this level: BLOCKER, CRITICAL, MAJOR, MINOR, INFO (default: CRITICAL)', 'CRITICAL')
   .option('--include <paths>', 'Comma-separated list of file paths glob patterns to include')
   .option('--exclude <paths>', 'Comma-separated list of file paths glob patterns to exclude')
@@ -135,6 +137,8 @@ program
     let baseBranch = null;
     let baseCommit = null;
 
+    // Precedence: --base > --base-commit > other scope flags. The base modes already diff
+    // against the working tree, so they include uncommitted and untracked changes too.
     if (options.base) {
       scanType = 'base-branch';
       baseBranch = options.base;

src/index.js

@@ -639,8 +639,8 @@ export function createMcpServer() {
           .optional()
           .describe('Review scope. Default "uncommitted".'),
         lastNCommits: z.number().int().positive().max(5).optional(),
-        baseBranch: z.string().optional(),
-        baseCommit: z.string().optional(),
+        baseBranch: z.string().optional().describe('Branch for scope "base-branch". Reviews committed, uncommitted and untracked changes since the merge-base with this branch.'),
+        baseCommit: z.string().optional().describe('Commit for scope "base-commit". Reviews committed, uncommitted and untracked changes since this commit.'),
         include: z.array(z.string()).optional().describe('Glob patterns to include.'),
         exclude: z.array(z.string()).optional().describe('Glob patterns to exclude.'),
       },

src/mcp/server.js

@@ -460,41 +460,50 @@ class GitDiffHelper {
 
     // Handle untracked files by generating synthetic "new file" diffs since git diff can't see them
     for (const file of expandedUntrackedFiles) {
-      try {
-        const absolutePath = path.resolve(this.gitRoot, file);
-        const content = await fs.readFile(absolutePath, 'utf8');
-        const lines = content.split('\n');
-
-        let patchStr = `diff --git a/${file} b/${file}\n`;
-        patchStr += `new file mode 100644\n`;
-        patchStr += `index 0000000..${this._generateRandomHash()}\n`;
-        patchStr += `--- /dev/null\n`;
-        patchStr += `+++ b/${file}\n`;
-        patchStr += `@@ -0,0 +1,${lines.length} @@\n`;
-        lines.forEach(line => { patchStr += `+${line}\n`; });
-
-        diffs.push({
-          base_file_str: '',
-          head_file_str: content,
-          patch_str: patchStr,
-          filename_str: file,
-          edit_type_str: 'ADDED',
-          old_filename_str: null,
-          num_plus_lines_str: String(lines.length),
-          num_minus_lines_str: '0',
-          tokens_str: String(content.split(/\s+/).length),
-          start_line_str: '1',
-          end_line_str: String(lines.length),
-        });
-      } catch (error) {
-        // Skip files that can't be read
-      }
+      const diff = await this._buildUntrackedFileDiff(file);
+      if (diff) diffs.push(diff);
     }
 
     this.baseCommit = originalBaseCommit;
     return diffs;
   }
 
+  /**
+   * Build a synthetic "new file" diff for an untracked file, which git diff can't see.
+   * Returns null if the file can't be read.
+   */
+  async _buildUntrackedFileDiff(file) {
+    try {
+      const absolutePath = path.resolve(this.gitRoot, file);
+      const content = await fs.readFile(absolutePath, 'utf8');
+      const lines = content.split('\n');
+
+      let patchStr = `diff --git a/${file} b/${file}\n`;
+      patchStr += `new file mode 100644\n`;
+      patchStr += `index 0000000..${this._generateRandomHash()}\n`;
+      patchStr += `--- /dev/null\n`;
+      patchStr += `+++ b/${file}\n`;
+      patchStr += `@@ -0,0 +1,${lines.length} @@\n`;
+      lines.forEach(line => { patchStr += `+${line}\n`; });
+
+      return {
+        base_file_str: '',
+        head_file_str: content,
+        patch_str: patchStr,
+        filename_str: file,
+        edit_type_str: 'ADDED',
+        old_filename_str: null,
+        num_plus_lines_str: String(lines.length),
+        num_minus_lines_str: '0',
+        tokens_str: String(content.split(/\s+/).length),
+        start_line_str: '1',
+        end_line_str: String(lines.length),
+      };
+    } catch (error) {
+      return null;
+    }
+  }
+
   async _getStagedChanges() {
     const { stdout: stagedFiles } = await execAsync(
       'git diff --name-only --cached HEAD',
@@ -525,7 +534,8 @@ class GitDiffHelper {
 
   /**
    * Get diff against a specific base branch.
-   * Finds the merge-base between the given branch and HEAD, then diffs from there.
+   * Finds the merge-base between the given branch and HEAD, then diffs it against the
+   * working tree (committed + staged + unstaged + untracked).
    */
   async _getBaseBranchDiff(branch) {
     if (!this.gitRoot) {
@@ -561,32 +571,12 @@ class GitDiffHelper {
       base = resolvedRef;
     }
 
-    const { stdout: changedFiles } = await execAsync(
-      `git diff --name-only ${base} HEAD`,
-      { cwd: this.gitRoot }
-    );
-
-    const files = changedFiles.split('\n').map(f => f.trim()).filter(Boolean);
-    if (files.length === 0) return [];
-
-    const originalBaseCommit = this.baseCommit;
-    try {
-      this.baseCommit = base;
-      this._headRef = 'HEAD';
-
-      const diffs = await Promise.all(
-        files.map(fp => this.getDiffInfoForFile(fp))
-      );
-      return diffs.flat();
-    } finally {
-      this.baseCommit = originalBaseCommit;
-      this._headRef = null;
-    }
+    return this._getWorkingTreeDiffAgainst(base);
   }
 
   /**
    * Get diff against a specific base commit.
-   * Diffs from the given commit to HEAD.
+   * Diffs from the given commit to the working tree (committed + staged + unstaged + untracked).
    */
   async _getBaseCommitDiff(commit) {
     if (!this.gitRoot) {
@@ -605,23 +595,43 @@ class GitDiffHelper {
       throw new Error(`Could not resolve commit: ${commit}`);
     }
 
+    return this._getWorkingTreeDiffAgainst(resolvedCommit);
+  }
+
+  /**
+   * Diff a base commit against the working tree: commits since base, staged and unstaged
+   * changes (including staged new files), plus untracked files not ignored by .gitignore.
+   * Content is read from disk so it matches the patch, which getFileDiff also takes against
+   * the working tree.
+   */
+  async _getWorkingTreeDiffAgainst(base) {
+    // No HEAD argument: compares base to the working tree, which covers tracked files that
+    // were committed, staged or edited since base
     const { stdout: changedFiles } = await execAsync(
-      `git diff --name-only ${resolvedCommit} HEAD`,
+      `git diff --name-only ${base}`,
+      { cwd: this.gitRoot }
+    );
+    const { stdout: untrackedStr } = await execAsync(
+      'git ls-files --others --exclude-standard',
       { cwd: this.gitRoot }
     );
 
     const files = changedFiles.split('\n').map(f => f.trim()).filter(Boolean);
-    if (files.length === 0) return [];
+    const untrackedFiles = untrackedStr.split('\n').map(f => f.trim()).filter(Boolean);
+    if (files.length === 0 && untrackedFiles.length === 0) return [];
 
     const originalBaseCommit = this.baseCommit;
     try {
-      this.baseCommit = resolvedCommit;
-      this._headRef = 'HEAD';
+      this.baseCommit = base;
+      this._headRef = null;
 
       const diffs = await Promise.all(
         files.map(fp => this.getDiffInfoForFile(fp))
       );
-      return diffs.flat();
+      const untrackedDiffs = await Promise.all(
+        untrackedFiles.map(fp => this._buildUntrackedFileDiff(fp))
+      );
+      return [...diffs.flat(), ...untrackedDiffs.filter(Boolean)];
     } finally {
       this.baseCommit = originalBaseCommit;
       this._headRef = null;
@@ -762,35 +772,8 @@ class GitDiffHelper {
 
       // Handle untracked files with synthetic diffs
       for (const file of expandedUntrackedFiles) {
-        try {
-          const absolutePath = path.resolve(this.gitRoot, file);
-          const content = await fs.readFile(absolutePath, 'utf8');
-          const lines = content.split('\n');
-
-          let patchStr = `diff --git a/${file} b/${file}\n`;
-          patchStr += `new file mode 100644\n`;
-          patchStr += `index 0000000..${this._generateRandomHash()}\n`;
-          patchStr += `--- /dev/null\n`;
-          patchStr += `+++ b/${file}\n`;
-          patchStr += `@@ -0,0 +1,${lines.length} @@\n`;
-          lines.forEach(line => { patchStr += `+${line}\n`; });
-
-          diffs.push({
-            base_file_str: '',
-            head_file_str: content,
-            patch_str: patchStr,
-            filename_str: file,
-            edit_type_str: 'ADDED',
-            old_filename_str: null,
-            num_plus_lines_str: String(lines.length),
-            num_minus_lines_str: '0',
-            tokens_str: String(content.split(/\s+/).length),
-            start_line_str: '1',
-            end_line_str: String(lines.length),
-          });
-        } catch (err) {
-          // skip
-        }
+        const diff = await this._buildUntrackedFileDiff(file);
+        if (diff) diffs.push(diff);
       }
     } finally {
       this.baseCommit = originalBaseCommit;